PT-2016-3746 · Puppet · Puppet Enterprise

Publicado 2016-01-08 · Atualizado 2019-07-10 · CVE-2015-7328

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.8.3 Puppet Enterprise versions prior to 2015.2.3

Description The issue concerns the use of world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration of Puppet Server in Puppet Enterprise. This might allow local users to obtain sensitive information via unspecified vectors.

Recommendations For versions prior to 3.8.3, update to version 3.8.3 or later to resolve the issue. For versions prior to 2015.2.3, update to version 2015.2.3 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-7328

Produtos afetados

Puppet Enterprise

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-7328 · Nota de Segurança
• https://puppetlabs.com/security/cve/cve-2015-7328 · Aviso do Fabricante